locking down approval list